This is a tool I wrote a while back to keep track of file changes and detect corruption. It basically makes a CSV for that folder with enough details to detect change.

Where to use it: flash drives, magnetic drives, PCIe drives, RAID 0-6 clusters(I personally use hardware based RAID 0 for gaming, and hardware based RAID 1 or 6 for servers)What does it run on: Everything PureBASIC does(OSX not tested but should work). I intentionally don't use API hooks etc..What it's not: Some volume-sandbox like DeepFreeze or S.M.A.R.T monitor tool like SpinRiteBest use cases:

"offline" volume or backup scans where rootkits are expected to be hiding files since antiviruses are purely at the mercy of signature databases even in their heuristic modes. The only malware this won't detect are rare cases like TDL4 that makes it's own custom file system outside of the active volume. Most antivirus's still don't detect that if it's obfuscated during install..

Detect corrupted or changed file or folder on demand

Optimizations: Doesn't generate CRC32 for file where it hasn't changed size since last scanPotential improvements: Cache(although pagefile or swap should take care of bigger scans), CLI interface for batch automated daemons, adaptive Delay() based on CPU %(requires API polling), privilege adoption to handle custom and protected ACLs like SYSTEM and chmod 600 etc..

It averages around 1.8% CPU and 3.4MB RAM on my Windows 10 Arrandale dual-core Laptop doing a scan of my 1TB USB backup drive that has a lot of GiB ISO files.

HOW TO USE IT:

Click "Browse" and select a folder or drive

If you are verifying a folder or drive that already has a valid hashes.txt in it then check the "Verify" box

Click "Start"

Wait for "Stop" on "Start" button to turn to "Start"(There is also the progress bar as an indicator). You can click stop at any time.

Optionally copy and paste the output to "hashes.txt" in the target folder so you can use the results to verify or save time on the next scan.

Thank, I was planning lot of times to make similar utility (to track windows system folders) but didn't make yet anything better than few dirty things on VB6, used in some cases in past ^^ Will try your code for that

UPD: seems PB-only code is not enough anyway, as it is fooled by symbolic links

fixed a bug in name handling. Old logs won't work anymore because I wrap relative paths in Chr(34). Just wrap paths with Chr(34) and old logs work.

Code:

;make your old hashes.txt work with new buildaa$=OpenFileRequester("","","*.*",0)If aa$ If ReadFile(0,aa$,#PB_File_SharedRead|#PB_File_SharedWrite|#PB_UTF8) While Eof(0)=0 bb$=Trim(ReadString(0)) For i = Len(bb$) To 1 Step -1 If Mid(bb$,i,1)="," For ii = (i-1) To 1 Step -1 If Mid(bb$,ii,1)="," Break 2 EndIf Next EndIf Next Debug Chr(34)+ReplaceString(bb$,",",Chr(34)+",",#PB_String_NoCase,ii,1) Wend CloseFile(0) EndIfEndIfEnd

Lunasole wrote:

Thank, I was planning lot of times to make similar utility (to track windows system folders) but didn't make yet anything better than few dirty things on VB6, used in some cases in past ^^ Will try your code for that

UPD: seems PB-only code is not enough anyway, as it is fooled by symbolic links

Yeah it's the same across OSX, Debian, and Windows. NTFS alt-streams also don't get handled. There are probably cases where chmod or other forms of ACL break it too. I remember back with XP SP3 you use to have to sweep all folders and files on drive swaps in some cases to fix ACLs with low level tools. Finite extensions might fix symlinks without fighting with APIs. I don't remember all the specifics for each platform.